Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 22:11
Behavioral task
behavioral1
Sample
5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed.dll
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed.dll
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed.dll
-
Size
208KB
-
MD5
0086e369c3eedec177821315116d264c
-
SHA1
8a499e2c20d08760dfd0398b27392cd4743e42a0
-
SHA256
5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed
-
SHA512
dd205ee8b402e12caa653b148aa9344240dc5c2d7805daf7cd2f70dacb7da031a7a16cabf6d3c203818f6e8bf67aa1b72ed043500c5ddfee3fe5225f8c4e77f2
-
SSDEEP
3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUCY5l:LIDff9D8C6XYRw6MT2DEj
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2104 2720 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2720 2344 rundll32.exe rundll32.exe PID 2720 wrote to memory of 2104 2720 rundll32.exe WerFault.exe PID 2720 wrote to memory of 2104 2720 rundll32.exe WerFault.exe PID 2720 wrote to memory of 2104 2720 rundll32.exe WerFault.exe PID 2720 wrote to memory of 2104 2720 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5110e79289fc541276736824717c57e25072d1fdeb816ae46c6b95243a99cfed.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 2323⤵
- Program crash